kimen

Keep secrets out of your project.

Your application needs database URLs, API keys and private files. That does not mean they should sit in .env beside the code.

Kimen stores the values in a local encrypted vault. Your project keeps only the names it needs. When the application starts, Kimen supplies the real values directly to that process.

Safe to keep with the project DATABASE_URL → dev.database_url The name and mapping are visible. The database URL is not.
Install KimenSee how it works

.gitignore keeps a secret out of Git. Not out of your workspace.

The familiar setup is simple. Create .env, put production-like credentials in it and make sure nobody commits the file.

But the plaintext value is still there on every developer machine. Editors, local scripts and coding agents with workspace access can read it. Every copied file must be created, protected, updated and eventually removed.

  • The project contains reusable credentials even when Git does not.
  • A tool which can read the code can often read the secrets beside it.
  • When a value changes, every local copy can become stale.
  • Once a secret has been read into output, logs or agent context, it cannot be unread.

The application needs the value while it runs. The workspace does not need to store it.

Keep the names with the code. Keep the values in Kimen.

Kimen does not require an application library or a new configuration API. Your application continues to read normal environment variables and files.

Store the value

Kimen prompts without putting the value in shell history or a plaintext project file.

kimen secret set dev.database_url

Declare what the project needs

The committed map contains the environment-variable name and its Kimen reference, not the secret value.

env DATABASE_URL=dev.database_url .kimen/profiles/dev.kmap

Start the application

Kimen resolves the map and gives DATABASE_URL only to the application process.

kimen run --profile dev -- ./app

The project describes what it needs. The local environment supplies the values.

The secret appears inside the application's runtime, not inside the project.

The code and committed Kimen map remain useful to developers, scripts and agents without containing plaintext values. Kimen prepares a runtime environment containing the application and the selected configuration.

Kimen prepares an application runtime without storing secrets in its project The project contains application code and names of required values. Editors, scripts and coding agents can work there without plaintext secrets. Kimen reads the map, resolves encrypted values from its vault and prepares a runtime environment containing the application and its environment variables. PROJECT WORKSPACE Application code reads DATABASE_URL COMMITTED KIMEN MAP DATABASE_URL → dev.database_url NAMES, NOT VALUES Workspace tools editors · scripts · agents kimen prepares LOCAL VAULT •••••••• RUNTIME ENVIRONMENT prepared for this invocation Your application runs normally AVAILABLE IN THIS ENVIRONMENT DATABASE_URL postgres://…8f2 STRIPE_API_KEY sk_live_…A7
The application and its environment variables are inside the runtime prepared by Kimen. The project contains only names and references.

Use the same stored values for the programs which need them.

Run a local application or test. Render a private file for software which requires one. Prepare an envfile for a process manager.

Run an application
kimen run --profile dev -- ./app
Run a test suite
kimen run --profile test -- ./test
Render required files
kimen render --dir ./runtime --profile staging
Prepare an envfile
kimen envfile --out .env.runtime --profile worker

By default, every command which opens the vault asks for its passphrase. Several runs ahead? Open a short session with kimen session start --ttl 15m, then close it with kimen session lock.

Sometimes nobody needs the credential. They need one operation.

Kimen Operations extends the same project-and-environment model to work such as restart_worker(queue). A developer, CI job or agent receives the approved result without receiving the production credential behind it.

See Kimen Operations →

Start with one secret.

Move it out of the workspace. Keep the application unchanged. Kimen is local, open source, usable offline and requires no account.

Install KimenView source ↗